All vulnerabilities
CVE-2026-107395GHSA-6p4f-j8j6-463qPYSEC-2026-4226

Indico: Missing access check in legacy session export API

indico indicopipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.3.13Fixed versionGitHub
Published8 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 3.3.13indico, pipGitHub
  • 3.3.13indico, PyPIOSVpip install "indico>=3.3.13"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

A legacy API to retrieve session details could be misused to retrieve metadata (such as title, description and conveners) of a restricted session within without having access to that session, as long as the event itself was accessible.

Patches

You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update.

Workarounds

Restrict access to the event itself

For more information

If you have any questions or comments about this advisory:

  • Open a thread in our forum
  • Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)

Text from GitHub Advisory Database

Affected versions 53

  • indico, pip< 3.3.13GitHub
  • indicoaffected: < 3.3.13CVE List
  • indico, PyPIfrom first release, fixed in 3.3.13OSV
  • indico, PyPI0.98-rc1OSV
  • indico, PyPI0.98.0OSV
  • indico, PyPI0.98.1OSV
  • indico, PyPI0.98.2OSV
  • indico, PyPI0.99OSV
  • indico, PyPI1.0OSV
  • indico, PyPI1.1OSV
  • indico, PyPI1.1.1OSV
  • indico, PyPI1.1.2OSV
  • indico, PyPI1.2OSV
  • indico, PyPI1.2.1OSV
  • indico, PyPI1.2.1rc10OSV
  • indico, PyPI1.2.1rc11OSV
  • indico, PyPI1.2.1rc2OSV
  • indico, PyPI1.2.1rc4OSV
  • indico, PyPI1.2.1rc5OSV
  • indico, PyPI1.2.1rc6OSV
  • indico, PyPI1.2.1rc7OSV
  • indico, PyPI1.2.1rc9OSV
  • indico, PyPI1.2.2OSV
  • indico, PyPI1.2.2rc1OSV
  • indico, PyPI1.9.11.dev10OSV
  • indico, PyPI1.9.11.dev11OSV
  • indico, PyPI1.9.11.dev12OSV
  • indico, PyPI1.9.11.dev13OSV
  • indico, PyPI1.9.11.dev14OSV
  • indico, PyPI1.9.11.dev15OSV
  • indico, PyPI1.9.11.dev16OSV
  • indico, PyPI1.9.11.dev17OSV
  • indico, PyPI1.9.11.dev3OSV
  • indico, PyPI1.9.11.dev4OSV
  • indico, PyPI1.9.11.dev6OSV
  • indico, PyPI1.9.11.dev7OSV
  • indico, PyPI1.9.11.dev8OSV
  • indico, PyPI1.9.11.dev9OSV
  • indico, PyPI2.0OSV
  • indico, PyPI2.0.1OSV
  • indico, PyPI2.0.2OSV
  • indico, PyPI2.0.3OSV
  • indico, PyPI2.0a1OSV
  • indico, PyPI2.0rc1OSV
  • indico, PyPI2.0rc2OSV
  • indico, PyPI2.1OSV
  • indico, PyPI2.1.1OSV
  • indico, PyPI2.1.10OSV
  • indico, PyPI2.1.11OSV
  • indico, PyPI2.1.2OSV
  • indico, PyPI2.1.3OSV
  • indico, PyPI2.1.4OSV
  • indico, PyPI2.1.5OSV

References 5